MiPfnRangeIsZero

VOID __stdcall MiPfnRangeIsZero(VOID *DeleteVa, VOID *DeleteEndVa){
  unsigned __int64 v2; 
  UINT64 v3; 
  UINT64 v4; 
  UINT64 v5; 
  UINT64 v6; 
  NTSTATUS v7; 
  int v8; 
  _MMPTE *PteBase; 
  __int64 v10; 
  signed __int64 v11; 
  __int64 v12; 
  UINT64 v13; 
  UINT64 v14; 
  __int64 v15; 
  _MMPFN *PfnDb; 
  _MMPFN *v17; 
  __int64 v18; 
  UINT64 v19; 
  UINT64 v20; 
  struct _KPRCB *CurrentPrcb; 
  __int64 CachedResidentAvailable; 
  bool v23; 
  signed __int32 v24; 
  __int64 v25; 
  unsigned __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  INT64 *v29; 
  _MMPFN *a2[2]; 
  __int128 v31; 
  int v32; 
  UINT64 v33; 
  __int64 v34; 

  v2 = (unsigned __int64)DeleteEndVa;
  v3 = (UINT64)DeleteVa;
  *(_OWORD *)a2 = 0i64;
  if( DeleteEndVa > (char *)MmPfnDatabase + 4096 * MxPfnAllocation )
    v2 = (unsigned __int64)MmPfnDatabase + 4096 * MxPfnAllocation;
  v31 = 0i64;
  if( (unsigned __int64)DeleteVa >= v2 )
    return;
  v4 = 0i64;
  v5 = 0i64;
  v6 = 0i64;
  v29 = 0i64;
  do
  {
    v7 = MI_IS_PHYSICAL_ADDRESS((VOID *)v3);
    v8 = v7;
    PteBase = MmGetPteBase();
    v10 = 1i64;
    v11 = (signed __int64)PteBase + ((v3 >> 9) & 0x7FFFFFFFF8i64);
    v34 = 1i64;
    LODWORD(v12) = 3;
    if( v7 > 0 )
    {
      v27 = (unsigned int)v7;
      do
      {
        LODWORD(v12) = v12 - 1;
        v11 = (signed __int64)PteBase + (((unsigned __int64)v11 >> 9) & 0x7FFFFFFFF8i64);
        --v27;
      }
      while( v27 );
      if( (_DWORD)v12 != 3 )
      {
        v12 = (unsigned int)(v12 - 1);
        v10 = MiLargePageSizes[v12];
        v34 = v10;
      }
    }
    if( (((v10 << 12) - 1) & v3) == 0 && v2 - v3 >= v10 << 12 )
    {
      if( (*(_BYTE *)v11 & 0x20) != 0 )
      {
        v25 = 512 - (((unsigned __int64)v11 >> 3) & 0x1FF);
        v26 = (unsigned __int64)PteBase + ((v2 >> 9) & 0x7FFFFFFFF8i64);
        if( v7 > 0 )
        {
          v28 = (unsigned int)v7;
          do
          {
            v26 = (unsigned __int64)PteBase + ((v26 >> 9) & 0x7FFFFFFFF8i64);
            --v28;
          }
          while( v28 );
        }
        if( ((v26 ^ v11) & 0xFFFFFFFFF000i64) == 0 )
          v25 = (__int64)(v26 - v11) >> 3;
        MiClearSystemAccessBits(v11, v25, (unsigned int)v7);
      }
      v32 = v8;
      if( v8 < 4 )
      {
        MiPteInShadowRange((UINT64)&v33);
        while( 1 )
        {
          LODWORD(v13) = MI_READ_PTE_LOCK_FREE(v11);
          v33 = v13;
          v14 = v13;
          if( v8 != v32 && (v13 & 0x20) != 0 )
            MiClearSystemAccessBits(v11, 1i64, 0i64);
          MiPreparePfnDatabasePageForFree(v11, (unsigned int)v8, (unsigned int)v12);
          v4 += v34;
          v15 = (v14 >> 12) & 0xFFFFFFFFFi64;
          PfnDb = MmGetPfnDb();
          v17 = &PfnDb[v15];
          v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = (__int64)a2[(unsigned int)v12];
          a2[(unsigned int)v12] = v17;
          if( v8 == 3 )
          {
            v29 = (INT64 *)v11;
            v6 = v11;
            if( !v5 )
              v5 = v11;
          }
          else
          {
            v6 = (UINT64)v29;
          }
          MiReplacePfnWithGapMapping((INT64 *)v11, (unsigned int)v8);
          LODWORD(v18) = MiGetContainingPageTable(v11 & 0xFFFFFFFFFFFFF000ui64);
          if( (PfnDb[v18].u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) != 1 )
            break;
          v34 = 1i64;
          LODWORD(v12) = 3;
          v11 = (signed __int64)MmGetPteBase() + (((unsigned __int64)v11 >> 9) & 0x7FFFFFFFF8i64);
          if( ++v8 >= 4 )
            goto LABEL_16;
        }
        v11 += 8i64;
      }
LABEL_16:
      v19 = v11;
      goto LABEL_17;
    }
    if( !MiDemoteValidLargePageOneLevel(v3) )
    {
      v19 = v11 + 8;
LABEL_17:
      LODWORD(v20) = MiGetLeafVa(v19);
      v3 = v20;
    }
  }
  while( v3 < v2 );
  if( v5 )
    MiReplicatePfnDatabaseMappings(v5, v6);
  _InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 573, -(__int64)v4);
  MiFreeLargeZeroPages((UINT64)&Irp, a2, 0i64);
  MiReturnCommit(&Irp, v4);
  CurrentPrcb = KeGetCurrentPrcb();
  CachedResidentAvailable = (int)CurrentPrcb->CachedResidentAvailable;
  if( (_DWORD)CachedResidentAvailable != -1 )
  {
    if( v4 + CachedResidentAvailable <= 0x100 )
    {
      do
      {
        if( v4 >= 0x80000 )
          break;
        v24 = _InterlockedCompareExchange(
                (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                CachedResidentAvailable + v4,
                CachedResidentAvailable);
        v23 = (_DWORD)CachedResidentAvailable == v24;
        LODWORD(CachedResidentAvailable) = v24;
        if( v23 )
          return;
      }
      while( v24 != -1 && v4 + v24 <= 0x100 );
    }
    if( (int)CachedResidentAvailable > 192
      && (_DWORD)CachedResidentAvailable != -1
      && (_DWORD)CachedResidentAvailable == _InterlockedCompareExchange(
                                              (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                                              192,
                                              CachedResidentAvailable) )
    {
      v4 += (int)CachedResidentAvailable - 192;
    }
  }
  if( v4 )
    _InterlockedExchangeAdd64((_QWORD *)&stru_140C50B28 + 883, v4);
}

Referenced by: